API Sandbox Intrusion Detection for Application-Level Threats
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection systems (IDS) primarily operate at the network or host level, lacking the ability to effectively detect and prevent API-level threats such as denial-of-service attacks and malware, as they do not have the capability to monitor and manage API calls at the application level.
Innovation Solution
An API-level intrusion detection system that intercepts API calls, parses them to extract names and parameters, and applies security rules to determine if they violate predefined security policies, allowing for proactive or reactive screening, with customizable rules and user interface for selection and management of APIs and security settings.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If intrusion detection systems operate at network or host level, then system simplicity is maintained, but the ability to detect API-level threats is insufficient
Solution Approach 1:
The patent introduces an API sandbox module as an intermediary component that sits between the API caller and the service provider. This sandbox intercepts API calls, extracts parameters, and forwards them to the intrusion detection rules execution engine for analysis against security rules, enabling API-level detection without requiring fundamental changes to the entire system architecture
Solution Approach 2:
The intrusion detection system is segmented into distinct functional modules: an API sandbox module for intercepting and parsing API calls, a rules execution engine for evaluating security rules, and a logging module for storing violations. This segmentation allows each component to be optimized independently while working together to provide comprehensive API-level detection
2Reliability
If API calls are intercepted and monitored at application level, then threat detection accuracy is improved, but processing overhead increases
Solution Approach 1:
The system performs preliminary actions by extracting and copying only the essential API call parameters (name, method, resource, headers, body) before forwarding to the rules execution engine. This preliminary extraction reduces the amount of data that needs to be processed and compared against security rules, improving throughput while maintaining detection accuracy
Solution Approach 2:
The API sandbox module creates a copy of the API call parameters and forwards this copy to the intrusion detection rules execution engine. This copying mechanism allows the original API call to proceed to the service provider while the copied parameters are analyzed for security violations, enabling parallel processing and reducing bottlenecks
3Adaptability or versatility
If security rules are customized and managed through user interface, then system adaptability is improved, but operational complexity increases
Solution Approach 1:
The system provides self-service capabilities through a user interface that allows administrators to directly create, modify, and delete security rules without requiring programming knowledge. The interface enables intuitive configuration of detection parameters, making the system adaptable to various threat scenarios while simplifying the operational complexity of rule management
Data Source
AI summary
This disclosure generally relates to computer security, and more particularly to methods and systems for application programming interface (API)-level intrusion detection. In some embodiments, a computer-readable medium is disclosed, storing instructions for: receiving an API call for a service at an API sandbox module; parsing the API call to extract at least one of: an API call name; and or one or more API call parameters; generating a copy of the at least one of: the API call name and or the one or more API call parameters; determining, via an intrusion detection rules execution engine, whether the API call violates one or more security rules obtained from a security rules object, using the copy of the at least one of: the API call name and or the one or more API call parameters; and providing an indication of whether the API call violates the one or more security rules.